1 Hidden Exponent RSA and Efficient Key Distribution author: He Ge Cryptology ePrint Archive 2005/325 PDFPDF 報告人：陳昱升

2 Abstract A variant of RSA public key scheme –called Hidden Exponent RSA scheme Based on this new scheme, we devised an efficient lightweight key management scheme and show that it is secure under the strong RSA assumption.

3 Outline Introduction RSA scheme Hidden Exponent RSA scheme Efficient Key Management Scheme Strong RSA Assumption Proof of the proposed scheme

4 Introduction Pervasive computing –computation can be carried out anywhere by any possible electronic devices. –eg: mobile computing, wireless Ad Hoc network, sensor network, etc. Key distribution/management problem –common secret keys in these devices compromise of some devices will reveal all communication. –public key cryptography consume lots of resources.

5 RSA Scheme e may be small (3, or 2^16+1) But d should be fairly large (above 1000 bit) to prevent attack

6 Hidden Exponent RSA scheme We choose d,k 160 bit, the encryption needs about 320 multiplication, while decryption needs about 160 multiplications. Total cost are about 480 multiplication. A balance of computation overhead for encryption and decryption. We can safely choose small d : When we hide e as the discrete logarithm of E, small decryption exponent attack will not be effective anymore.

7 Hidden Exponent RSA scheme To encrypt a random message

8 An Efficient Key Management Scheme Key generation center(KGC) generates many keypairs and distributes each keypair to each device. Keypair holders can implement an authenticated key exchange.

9 Parameter Setting of KGC

10 Keypair Generation To generate a keypair for a device –KGC picks random prime d (160 bit) and t (24 bit) –KGC computes –d is the private key and ( E,t ) is the public key – t is the unique identifier to represent a valid keypair. We will show that (d,E,t) is unforgeable.

11 Authenticated Key Exchange A randomly choose r a B randomly choose r b private d a public (, t a )public (, t b )private d b verify exchange

12 Traditional Authenticated Key Exchange A randomly choose r a B randomly choose r b private d a public (n a,e a )public (n b,e b )private d b Verify that the received public key has been authenticated by KAC. exchange

13 Comparison Traditional scheme New scheme Communication payload 3072 bits for each party 2048 bits for each party Modular multiplication 1344 ( *2) multiplication 480 (160*3) Multiplication

14 Strong RSA Assumption

15 Infeasible to forge a valid key Thm 1. Keypair Unforgeable Under the strong RSA assumption, there exists no polynomial time algorithm which takes a list of valid keypairs, (d 1,E 1,t 1 ), (d 2,E 2,t 2 ), …, (d k,E k,t k ) and produces a new keypair (d,E,t) such that E dt =g (mod n) such t≠t i for i=1,…,k.

16 Proof of Keypair Unforgeability Proof. (Illustration) –Suppose we have polynomial-time algorithm A which can compute a new valid keypair based on the available keypairs. A We use (d,t,E) to find a pair (y,t) such that y t =u (mod n). g n H

17 Proof of Keypair Unforgeability Proof. (Sketch)

18 Conclusion A public key scheme “Hidden Exponent RSA” Based on this scheme, we devised a lightweight key management scheme  Lower communication and computation overhead. Prove that the keypair forgery is infeasible under Strong RSA assumption.